Crater Security Vulnerability

Crater is an open source web and mobile application from Crater, Inc. for tracking expenses, payments and creating professional invoices and estimates. A security vulnerability exists in crater 6.0.6 and prior versions, which stems from a vulnerability that allows a super administrator to execute...

CVE-2022-1032

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...

Deserialization of untrusted data

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...

CVE-2022-1032

CVE-2022-1032 affects the Crater Invoice Crater project prior to 6.0.6, reported as insecure deserialization of unvalidated module files. The exploit path demonstrated in the documents involves uploading a manipulated Phar archive (phar.phar) via the web API, then triggering remote code execution...

CVE-2022-1032 Insecure deserialization of not validated module file in crater-invoice/crater

Insecure deserialization of not validated module file in GitHub repository crater-invoice/crater prior to 6.0.6...

Crater Invoice Crater 代码问题漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. A security vulnerability exists in Crater Invoice Crater versions prior to 6.0.6 that stems from insecure deserialization ...

CVE-2022-1033

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...

CVE-2022-1033

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...

CVE-2022-1033

CVE-2022-1033 affects crater-invoice/crater prior to 6.0.6 where there is no restriction on uploading dangerous file types. A PoC shows uploading a PHP webshell as an expense receipt, resulting in a stored file retrievable via attachment_receipt_url (e.g., /storage/50/2137webshell.php), enabling ...

CVE-2022-1033 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...

GitHub repository crater-invoice/crater 代码问题漏洞

GitHub is a suite of hosting platforms for open source and private software projects. A security vulnerability exists in the GitHub repository crater-invoice/crater prior to version 6.0.6, which stems from the application's lack of an upload restriction for dangerous types of files...

CVE-2022-0515

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0514

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...

CVE-2022-0514

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...

CVE-2022-0515

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0515

CVE-2022-0515 is a CSRF vulnerability in crater-invoice/crater prior to version 6.0.4. The issue affects the web application’s CSRF protection, enabling an attacker to cause a logged-in user to be logged out by visiting a malicious site (PoC shows triggering a logout). The condition is that the v...

CVE-2022-0515 Cross-Site Request Forgery (CSRF) in crater-invoice/crater

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0515 Cross-Site Request Forgery (CSRF) in crater-invoice/crater

Cross-Site Request Forgery CSRF in GitHub repository crater-invoice/crater prior to 6.0.4...

CVE-2022-0514 Business Logic Errors in crater-invoice/crater

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5...

CVE-2022-0514

CVE-2022-0514 affects crater-invoice/crater prior to 6.0.5. The issue is a business logic flaw in Crater’s settings handling that lets an attacker alter the currency by tampering a parameter in the API request (e.g., /api/v1/company/settings with currency set to 1 and changing it to 2). The impac...